Request for suggestion On Node & Interface Down Alerts

I'd say a modern dashboard is perfect for this idea. Create a custom SWQL code block with whatever details your company requires and then use an MD to display nodes and interface alerts side by side, or one above the other.

I think your biggest challenge will be in how to extract the data. A quick scroll through SWQL Studio shows me several tables that could help [Orion.AlertActive being the most promising] but how you "restrict" the data to current active alerts is the challenge. You could go with an approach that says: "if alert is not acknowledged then it must be Active" type of logic, but that relies on your users correctly acknowledging alerts in a timely manner. 

I think a better approach [or at least one I'd prefer and find useful] would be to show the alerts that triggered today. Then perhaps you could create multiple views for yesterday, this week, etc...

Hi stuartd ,

I'm experiencing difficulties in writing a query. Could you assist me by providing a SWQL query that I can use in my Modern Dashboard table widget? On one Modern dashboard, I need to display two types of active alerts as mentioned below:

1. The dashboard should display active alerts for nodes that are down, specifically for nodes with an ownership value of 'FKT'.

2. The dashboard should display active alerts for interfaces that are down, specifically for interfaces with an ownership value of 'FKT'.

-_-Thanks in Advance.

I am not a coder, and 99% of mine are acquired and edited.

Try having a look through the 'content exchange' and see if anything is there that you can adapt. This one: Active alerts with acknowledge notes might be a place to start. 

Sure stuartd I will check the suggested urls and update you.

I also did not the coding, but trying to learn SWQL. But the bad things is that i hardly found any resources about the SWQL.

Last few days, I am checking your last post which you post almost 3 years back and going through the resources which were shared by different user over your post.

 RE: SWQL Study Group for the complete novice - thoughts? 

The link Stuart linked is a good one, in your case you could just WHERE Alertname = 'Your node down alert' etc. Good to go.

I tried using your given idea, but it's now working and showing error as shown below

You are using the DatabaseManager and not the SWQL Studio.

You can't execute a SWQL query in DatabaseManager.

Try to download and install the SWQL Studio https://github.com/solarwinds/OrionSDK/releases

As a reference i paste that SQWL query and the same query i tried in the Modern dashboard but it's not working. I tried a new swql query as mentioned below and it's not giving any error neither any data is not showing.

Can you try to remove the WHERE condition ?

It's showing data, if i remove Where clause or if I add this "WHERE o.AlertActive.TriggeredMessage <> ''

But, I need only those active alerts which is related to node down and node ownership is FT

Do you have SWQL studio installed yet? If not, start there

Do you have SWQL studio installed yet? If not, start there

Not installed, I am testing the query directly in the Modern dashboard query section. Below mentioned query is almost showing all the data which i required, except Active alert time and Acknowledge status is not showing.

SELECT
o.AlertConfigurations.Name AS [ALERT NAME]
,'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:' + ToString(o.AlertObjectID) AS [_LinkFor_ALERT NAME]
,o.EntityCaption AS [ALERT OBJECT]
,o.EntityDetailsURL AS [_LinkFor_ALERT OBJECT]
,o.RelatedNodeCaption AS [RELATED NODE]
,o.RelatedNodeDetailsURL AS [_LinkFor_RELATED NODE]
,o.Node.IP_Address AS [IP ADDRESS]
,ToLocal(o.AlertActive.TriggeredDateTime) AS [ALERT TRIGGER TIME]
,o.AlertActive.TriggeredMessage AS [ALERT MESSAGE]
,CASE
WHEN o.AlertConfigurations.Severity = 1 then 'Critical'
WHEN o.AlertConfigurations.Severity = 2 then 'Serious'
WHEN o.AlertConfigurations.Severity = 3 then 'Warning'
WHEN o.AlertConfigurations.Severity = 4 then 'Informational'
WHEN o.AlertConfigurations.Severity = 5 then 'Notice'
END AS [Severity]
FROM Orion.AlertObjects o
WHERE o.AlertActive.TriggeredMessage <> ''
and o.AlertActive.TriggeredDateTime >= ADDHOUR(-720, GETDATE())
and o.AlertConfigurations.Name='Node is Down'
ORDER by o.AlertActive.TriggeredDateTime DESC

Get SWQL studio working, trying to work this any other way will lead to confusion

you'll get error messages and in-line autocomplete and error detection

 ImNishat If you are having a hard time getting SWQL studio installed you need to download the SolarWinds SDK. That link will take you to the page, just download the .MSI

if not SWQL studio , try to run it in the SWIS page - https://yourdomain/orion/Admin/swis.aspx that way you can validate your query in quicker time , have you find a solution already